Payment firms, asset managers, exchange houses and fintechs move money or hold assets over rails, platforms and APIs they do not own. An ordinary intrusion matters most where it reaches a shared platform, and the regulator you answer to depends on your license.
After a material cyber event, by regulator. Find your regulator. The clock starts when the event is material, not when the facts are clear.
Phishing, a stolen password, or a flaw in an internet-facing system.
22%of financial and insurance breaches began with exploitation of a vulnerability (Verizon 2026 DBIR)Not only administrators. Staff who release payments or settle trades, holders of API credentials and signing keys, and the help desk that can reset them.
A payment rail, a custodian, a trading venue, a cloud provider or an API partner that many firms use at once.
Payment instructions, settlement files, wallet keys and customer balances. Whether one stolen identity is enough depends on how approvals and keys are controlled.
Of financial and insurance breaches involved a third party (Verizon 2026 DBIR)
There is no single cyber rule for every financial firm in the UAE. The Central Bank, the DFSA in DIFC, the FSRA in ADGM and VARA in Dubai each set their own. Find yours first.
Participation in the Central Bank’s Open Finance Regulation is mandatory for licensees, including payment providers, stored value providers and exchange houses. It requires a secure interface and at least two-factor authentication, and bars data scraping.
The Retail Payment Services and Card Schemes Regulation (Article 13) asks for a technology and cyber risk framework, the UAE Information Assurance Standards as a minimum, multi-factor authentication for high-risk transactions and a continuity plan tested at least yearly.
VARA requires a Chief Information Security Officer, independent penetration tests at least yearly and before new systems, quarterly audits of removed user access, and a continuity and recovery plan tested and updated every year.
Applies to Licensed Financial Institutions. Board-approved tolerance for disruption, third-party controls, and event notice within 4 hours (Art. 15.2.1).
Read the sourceMandatory for licensees. Secure interfaces, two-factor authentication, no scraping, and immediate notice of events that disrupt service.
Read the sourceCyber risk framework, multi-factor authentication for high-risk transactions and a yearly continuity test (Art. 13).
Read the sourceCISO, independent penetration tests, tested recovery plan, and incident reports within 72 hours for virtual asset firms in Dubai.
Read the sourceBaseline cyber rules for regulated entities in ADGM, in force since 31 January 2026, with incident reporting to the FSRA.
Read the sourceSource: Central Bank of the UAE, VARA and ADGM FSRA, instruments named above. This is analysis, not legal advice.
UAE rules, by who you are
The regulator depends on the licence: the Central Bank for payments and stored value, the Capital Market Authority (CMA, formerly the SCA) for securities, the FSRA in ADGM, the DFSA in DIFC. Virtual assets need their own check.
Regulator ruleCBUAE Retail Payment Services and Card Schemes Regulation, Stored Value Facilities Regulation and related technology-risk requirements.
Technology and cybersecurity risk management that fits the licensed activity. Adequate IT controls and cyber resilience. Keep payment systems secure, stable, reliable and available. Exact duties depend on licence type.
Regulator ruleCapital Market Authority (formerly SCA) financial activity and licensing requirements, and the risk-management and technology rules that apply.
Keep technical systems current. Address cyber risk. Document cyber risk management, data protection, software development and encryption arrangements. Follow the incident-reporting rules.
Confirm: The SCA became the Capital Market Authority on 1 January 2026. Confirm which CMA or earlier SCA instrument covers your licensed activity.
Regulator ruleADGM FSRA General Rulebook and Cyber Risk Management Rules, in effect from 31 January 2026.
A governing-body-approved cyber framework, an ICT asset inventory, regular risk assessment, and controls to protect, detect, respond and recover. Review the framework and train staff at least yearly. Report material cyber incidents to the FSRA immediately and no later than 24 hours after you become aware.
Confirm: FSRA guidance points to 24 hours in relevant cases.
Regulator ruleFSRA rules for the specific permission and activity.
Apply the FSRA cyber framework and the controls for your activity. Check wallets, key management, APIs, authentication, transaction systems and third-party platforms.
Regulator ruleDFSA Rulebook, General (GEN) Module, Cyber Risk Management Rules.
A governing-body-approved framework reviewed regularly, with the incident response plan reviewed at least yearly. A current ICT asset inventory. Regular risk assessment. Yearly staff training. Notice of a material incident no later than 72 hours.
Regulator ruleDFSA GEN Module cyber risk management rules plus the DFSA rules for your activity.
Proportionate cyber controls. Secure customer-facing apps, APIs, remote access, transaction systems and third-party links.
Regulator ruleLicensing and cyber rules of the competent regulator: VARA, the DFSA in DIFC, or another.
Work out which regulator holds your licence first. Then apply its technology, custody, wallet, cybersecurity and incident-reporting rules.
Confirm: The regulator depends on jurisdiction and activity.
Contract termThe regulated client’s rules, passed down by contract.
Security, audit, incident-notice, data-handling and continuity terms set by the client. Company size alone does not decide whether you are regulated.
This is analysis, not legal advice. A security control does not automatically mean an annual audit or a fixed test cycle. We state a frequency only where the rule does. Rules differ by regulator, so one regulator’s deadline does not carry over to another’s firms. Confirm your licence, the current rulebook and any regulator direction with your counsel.
The same security decision gets a different answer once partners, keys and several regulators are in the picture.
By what stops if they fail: the payment rail, custodian, venue or API partner your service cannot run without.
Usual adviceBy spend, or by the data they hold.
A right to move money or read customer data. Partner and open finance credentials need owners, limits and a fast way to revoke.
Usual adviceA technical secret for developers to manage.
Possibly several. A group can hold a Central Bank license, a DIFC or ADGM entity and a VARA license, each with its own clock.
Usual adviceOne regulator and one deadline.
Restore payment instructions, settlement files and balances in a state you can reconcile, and agree with partners what each one holds.
Usual adviceRestore the systems from backup.
Add the paths that move value: partner connections, approval and signing steps, and the help desk.
Usual adviceA yearly penetration test of your own systems.
UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.
Card, privacy, resilience and assurance standards reach a financial firm through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.
Payment Card Industry Data Security Standard
Any card acceptance, payment processing or card issuing.
Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.
Source: PCI Security Standards CouncilEU General Data Protection Regulation
You offer services to people in the EU or have an EU entity in the group.
A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).
Source: EUR-Lex, Regulation (EU) 2016/679EU Digital Operational Resilience Act
EU investment, payment, e-money, crypto and fund firms, and the ICT providers that serve them.
Applies from 17 January 2025. Major ICT incidents go to the authority in stages: initial, intermediate and final report.
Source: EUR-Lex, Regulation (EU) 2022/2554AICPA System and Organization Controls 2
Asked of platforms and administrators that hold client data for you.
An auditor’s report on a provider’s controls for security, availability, processing integrity, confidentiality and privacy. No law requires it. Many buyers do.
Source: AICPA, SOC suite of servicesInformation security management systems
A common evidence point in supplier and client due diligence.
The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.
Source: ISO, ISO/IEC 27001Map each licensed entity to its regulator and the cyber and incident rules that follow.
List rails, custodians, venues, cloud and API partners, and rate each by the service it can interrupt.
Check who owns partner and open finance credentials, what limits apply and how fast access can be cut.
Run a table-top for a partner failure and a payment fraud, with a named caller for each regulator.
Sources and method. This page is analysis, not legal advice.
